Machines are changed after sale: new software, new functions, retrofits, a different tool. Article 18 of the Machinery Regulation says that whoever makes a substantial modification is treated as the manufacturer and takes on the manufacturer's obligations, for the whole machine or, in an assembly, for the part the change affects. That includes the risk assessment, the technical documentation, the conformity assessment and a new declaration.
The question is when a change is substantial. The answer is narrower than many assume.
The definition, condition by condition
A substantial modification is a modification of machinery by physical or digital means, after it was placed on the market or put into service, that (Art. 3(16)):
- was not foreseen or planned by the manufacturer;
- affects safety by creating a new hazard or increasing an existing risk;
- and requires either the addition of guards or protective devices whose processing needs a change to the existing safety control system, or additional protective measures for stability or mechanical strength.
All of the conditions must be met, not some of them. A change that adds a hazard but can be handled without new protective measures is not substantial under this definition. Recital 26 adds that repair and maintenance that leave compliance untouched are not substantial modifications. A non-professional who changes their own machine for their own use does not become a manufacturer under Article 18.
"By digital means"
The definition names digital means explicitly. A software change can be a substantial modification if it meets the conditions, for example a new automatic function that brings a moving part closer to people and needs a new protective device processed by the safety controller.
What "foreseen or planned" means for you as the original manufacturer
The first condition is the one you control. Changes you foresee and plan, and assess in advance, are not substantial modifications. That is the case for an envelope: write down which software changes your update procedure allows, which limits stay fixed, and how each release is verified. A release inside that envelope is a planned change. A third-party tool that rewrites a safety limit is not, and your protection of the limits (1.2.1(d)) should prevent it anyway.
Four typical scenarios
| Change | Substantial? | Why |
|---|---|---|
| Security patch inside the planned update procedure | No | Foreseen and planned; verified as a safety change before release |
| New comfort function in the operator app, no effect on safety functions | No | Does not create a hazard or increase a risk |
| Dealer raises a speed limit with a service tool | Possibly | Not planned; may increase a risk. Your design should make it impossible |
| Retrofit of an automatic mode that needs a new light curtain processed by the safety controller | Yes | Not planned, new hazard, new protective device in the safety control system |
The CRA uses a different test
Under the Cyber Resilience Act a substantial modification is a change that affects compliance with the essential cybersecurity requirements or changes the intended purpose (CRA Art. 3(30)). A change can be substantial under one regulation and not the other. Assess both and record both answers.
Record the assessment
For each change: what changed and who changed it, whether it was within the planned envelope, each condition of Article 3(16) with a yes or no and a reason, the same for the CRA, the conclusion, and who decided when. If the conclusion is "substantial", the obligations of Article 18 apply before the modified machine is used or made available.
This article explains Regulation (EU) 2023/1230 in plain words. It is not legal advice.